Daily Recap, The latest security alerts cover a broad sweep of breaches, from a Vinomofo data protection ruling and a major Conduent breach to widespread misinformation around Gmail and a surge in NPM credential theft campaigns. The report also highlights tools and flaws enabling rapid credential harvesting, patching gaps, botnet attacks on PHP/IoT, AI misuse in executive-targeted campaigns, and notable industry moves like Reflectiz funding and Spektrum Labs’ market entry. #Vinomofo #Conduent #GmailHoax #WPPluginLeak #PhantomRaven #NPM #LoginsZip #Dovecot #TotalJS #Copilot #DNSOutage #Mirai #Gafgyt #Mozi #BlueNoroff #AICloking #MaliciousSEO #ThreatsDay #ExploitsSold #M&SImpact #Reflectiz #SpektrumLabs #Herodotus
Category: Daily Recap
![Cybersecurity News | Daily Recap [30 Oct 2025]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [30 Oct 2025]")
Daily Recap, Russian-linked actors used living-off-the-land techniques to breach Ukrainian organizations, while BlueNoroff leveraged AI-enhanced espionage on macOS to social-engineer victims. Major vulnerabilities and breaches, from Tomcat flaws to DELMIA alarms, underscore rapid attack surface expansion across industries. #RussianBreaches #BlueNoroffAI #TomcatFlaws #DELMIAWarning #ConduentBreach #DentsuMerkle #RavinAcademy #UKAfghanLeak
Daily Recap, The week highlights new Android malware like Herodotus and Baohuo, a Chrome zero-day delivering Memento Labs/LeetAgent spyware, and SideWinder shifting to a PDF/ClickOnce chain targeting South Asian diplomacy with StealerBot. These items underscore evolving threat techniques across APTs, ransomware, and supply-chain incidents—watch for updates on Xortec, Dublin Airport data, and Oracle-related vulnerabilities. #Herodotus #Baohuo #MementoLabs #LeetAgent #SideWinder #StealerBot #Xortec #DublinAirport #OracleHack
Daily Recap, Ransomware Payments show shifting attacker economics in Q3 2025 as payments declined, signaling changing payout dynamics across the threat landscape. The Qilin Ransomware combines a Linux payload with a BYOVD exploit for hybrid attacks, broadening its cross-environment impact. #Qilin Ransomware #BYOVD
![Threat Research | Weekly Recap [26 Oct 2025]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [26 Oct 2025]")
Cybersecurity Threat Research ‘Weekly’ Recap. This week highlights a breadth of activity across ransomware, cloud and identity abuse, infostealers, APTs, phishing, and infrastructure abuse, with notable trends in cross‑platform extortion, OAuth persistence, ESP‑style backdoors, and supply‑chain abuse. The report also covers defensive tooling advancements, geopolitical cyber campaigns, and sector‑focused incident trends, including insights on detection challenges and emerging attacker techniques.
Daily Recap, Critical WSUS flaw in Windows Server is being actively exploited prompting an emergency patch and urgent mitigation guidance; OpenAI Atlas Omnibox vulnerability and Shadow Escape 0-click exploit raise concerns over AI assistants exposing data stores. Compromised YouTube accounts distribute an infostealer and a large YouTube malware network was taken down by Google and Check Point; a global smishing triad tied to 194,000 malicious domains fuels phishing campaigns. #WSUS #AtlasOmnibox #ShadowEscape #YouTubeInfostealer #SmishingTriad
Daily Recap, Microsoft patches critical WSUS RCE (CVE-2025-59287) and blocks NTLM hash theft via Preview, while multiple product flaws and active exploits raise supply chain and server risk. The broader landscape covers state and non-state actors deploying drone malware, DeskRAT variants, and ransomware waves, with notable incidents in healthcare, government, and e‑commerce sectors. #CVE-2025-59287 #NTLM #DeskRAT #Medusa #Genesis
Daily Recap, Nation-state Attacks and vulnerabilities highlight ongoing state-backed espionage and critical flaws impacting governments, enterprises, and researchers worldwide. Key actions include Lazarus targeting European defense firms, ToolShell exploits on governments, MuddyWater’s Phoenix backdoor campaigns, critical Adobe Magento flaws, and AI governance risks shaping security strategies. #Lazarus #ToolShell #MuddyWater #Phoenix #AdobeFlaw #Magento #Pwn2Own
Daily Recap, Oracle patching urgency follows active SSRF exploitation in E-Business Suite as researchers flag 94+ n-day Chromium vulnerabilities impacting IDE tooling. Also highlighted are Bitter APT’s WinRAR zero-day, PolarEdge expanding to new routers, and Passiveneuron/Neursite backdoors detected in campaigns.
#Oracle #SSRF #BitterAPT #WinRAR #PolarEdge #PassiveNeuron
Daily Recap, A critical RCE affects over 75,000 WatchGuard Firebox devices and a Windows SMB vulnerability is being exploited in attacks, with additional bug disclosures and a USB recovery fix. Threat actors and campaigns include Snappybee via Citrix, GlassWorm supply-chain, and COLDRIVER Russian malware families.
#WatchGuard #SMB #Snappybee #GlassWorm #COLDRIVER
Daily Recap, A roundup of vulnerabilities, detection tools, North Korea-linked activity, phishing, SIM fraud, breaches, and geopolitical cyber tension highlights recent patches, clever obfuscation techniques, and ongoing threat campaigns affecting enterprises and users worldwide. Authors emphasize the need for timely patching and vigilant monitoring to counter disclosures like ConnectWise Automate RMM, WatchGuard Fireware, Dolby zero-click, and OAuth-based stealth campaigns. #ConnectWise #WatchGuard #Dolby #Cazadora #MSS #NSA
Cybersecurity Threat Research ‘Weekly’ Recap. A wide range of state‑sponsored and criminal campaigns were observed, including DLL side‑loading, web shell persistence, spearphishing, credential theft, and rising concerns around rootkits, firmware threats, and supply‑chain abuse. The report also highlights new detection tools, research models, and mitigations across research & tooling, vulnerabilities, and OSS/open‑source risks.
#MustangPanda #FlaxTyphoon #Jewelbug #MysteriousElephant #APT35 #CavalryWerewolf #SOGU #PlugX #ValleyRAT #SecureBoot #FrameworkDevices #AdaptixC2 #BeaverTail #Oyster #NightMARE #ExCyTInBench #EclecticIQ #Snyk
Daily Recap, North Korea combines BeaverTail and OtterCookie into advanced JavaScript malware to steal data and cryptocurrency, while state-backed actors deploy diverse tooling including a new .NET CAPI backdoor and AI-enabled escalation techniques across Russia, China, and other regions. The update also highlights high-severity ASP.NET Core flaws, widespread data leaks such as Envoy’s Oracle E-Business breach, and SIM farm takedowns—reflecting broad, multi-vector threats and remediation efforts. #BeaverTail #OtterCookie #SilverFox #BulletproofChains #AIEscalation #Envoy #SIMFarmRaid
Daily Recap, Hackers stole sensitive bidding, customer and payment data from Sotheby’s and other major breaches, highlighting continued exposure across auction, marketplace, and education sectors. The report also notes critical vulnerabilities, notable malware/APT activity, and privacy concerns from surveillance partnerships and unencrypted traffic. #SothebysBreached #ProsperBreach #KearneyPublicSchools #WatchGuardVulnerable #LinkProRootkit #ChollimaOtterCookie
Daily Recap, Microsoft disrupted the Vanilla Tempest ransomware campaign by revoking over 200 fraudulent code-signing certificates, highlighting ongoing certificate disruptions in cybersecurity. Nations-state breaches exposed F5 BIG-IP source code and data, prompting CISA directives and emergency patches, while active exploits targeted Adobe AEM and other software, underscoring widespread vulnerability disclosures. #VanillaTempest #F5BREACH #AdobeAEM